Amazon Sues Fake Reviewers on Fiverr - <AUTHOR> http://www.bloomberg.com/news/articles/2015-10-16/amazon-targets-web-freelancers-peddling-fake-customer-reviews <comment><USER2> This is interesting - I do believe shill reviews are a form of fraud, and this lawsuit will put that perspective to the test. We'll get a court answer eventually.

What I find interesting is trying to prove harm done by the fake reviews. If they're against the terms of service, okay, ban the accounts, and take some back-room steps to monitor if those persons try to rejoin (e.g. limited utility of IP address focus). I don't think we're talking about criminal masterminds here.

I'm kind of joking here, but I'd almost try out the defense that paid five- star reviews are a "necessary evil" to counter the inevitable "idiot with a keyboard" which enables any wrong-thinking person to write a one-star review. What I mean is will this case include evidence that non-paid reviewers are just as damaging - if not more so - than paid fake ones. Or, in other words, can Amazon prove genuine harm via "fraud" is able to be differentiated from "stupid people saying stupid, wrong things" in the comment environment.

Personally, I think it's an "in-house" Amazon issue where they should be 'moderating' comments, but that takes labor and effort; if I've learned anything about Amazon's view of menial labor tasks such as fulfillment, I don't think anybody would want the job. If there's better money in fraud than policing the fraud, then maybe the business model should be re-evaluated. I'm not trying to justify what is done for hire - to me it's about on par with "essay writers for hire" and I hate that shit - but it does make for an interesting problem of commerce.

<comment><USER3> It's pretty obvious that it is far more damaging.

The reviews from "stupid people" are limited by the ratio of "stupid people" to "smart people", and thus merely change the scale and add some noise, mostly uniformly across all products in a given category: the system is worse, but still usable.

On the other hand, enough fake reviews on a system with discretized scores will result in all products having the maximum score and having almost all reviews presented being fake: the system is now completely useless.

<comment><USER4> Exactly this.

I've recently come across a lot of these very highly rated products (with thousands of reviews) and almost immediately you see many of the reviews saying "company gave me the product for free to write an honest and unbiased review."

To me, this completely invalidates the rating and I typically try to find a different product because it's too time consuming to try to find real reviews. On the other hand, 'stupid people' don't tip the scale like that and in some ways their reviews are useful because you can be sure those people were not 'paid'. Also, they may complain about something that isn't really a negative in general, or specifically to you, so you can use that to make your decision.

<comment><USER2> This reminds me of radio advertising on AM/FM - the personalities will frequently discuss how they've used the Service Provider X and you should too! They've received compensation. They're in the business of entertainment, yet are "breaking the fourth wall" to advertise.

I think I need to clarify a bit more though: Sometimes stupid people can be the loudest voice, as in, anti-vaccine folks who cite discredited science and refuse to back down. A more specific instance is when I worked retail - a guy bought his son a Nirvana CD, this one:

[http://images.weltrecords.de/img/cover/000/000/827/000000827...](http://images.weltrecords.de/img/cover/000/000/827/000000827012.jpg)

He came in with a head of steam at me, mad because he couldn't returned the opened disc, and said, "This is garbage, it sounds like a bunch of home demos!" But that's exactly what the CD was, a collection of demos being offered to people who were interested in such things. He wanted to give it 1 star, essentially, for it being exactly what it was supposed to be. That's...bullshit. But that's an example of how yeah, people might read the review and not find it helpful, but this is how an erroneous opinion is spread. Should moderating that be the role of the platform like Amazon?

For the record, I told him "Yes, that's what that CD is, and while you can't return it, you can probably sell it to a used CD store in your area and get a few bucks back. Here's the CD you want."

[http://3.bp.blogspot.com/_1FEoCdDUmoE/TQ8Gz27WulI/AAAAAAAAAu...](http://3.bp.blogspot.com/_1FEoCdDUmoE/TQ8Gz27WulI/AAAAAAAAAus/ALRdEKdy9AI/s1600/68116998.jpg)

Note: Edited due to accusations of shilling, now just images for your reference. Tough crowd.

<comment><USER5> Are the referral links really necessary in this context? The fact that you don't even mention the CD names makes this feel like click bait for Amazon referrals.

<comment><USER2> Haha wow, well, I guess if you want to see it that way. I can edit it to just show the graphics of the CD covers, so I'll do that. I seriously was not trying to plug anything, just, you know, give a citation for context. I'll fix it tout de suite.

</comment></comment></comment></comment></comment></comment><comment><USER6> Isn't this basic enough to be covered under tort law?

The reviewer is negligent through misrepresentation (withholding the fact that the reviewer is being paid) and Amazon suffers.

On a separate note, it's a shame that many of these reviews are bought by advertising agencies and the manufactures or the products usually have no idea when this is done. So the manufacture might be looking at online reviews thinking people love the product when in reality it's just some of the advertising they paid for.

<comment><USER7> "... the manufactures or the products usually have no idea when this is done"

Some of them (or at least the marketplace resellers) do. In an article linked from another discussion here on HN [0], there is evidence that some of the fake reviewers would have empty boxes shipped to them so they would have the "Verified Purchase" qualifier in the review, the kindle book sellers simply put their books in a free promotion for 5 days so the reviewers have the "Verified Purchase" even though the cost was $0.00

[0] [https://news.ycombinator.com/item?id=10402480](https://news.ycombinator.com/item?id=10402480)

<comment><USER8> These sound like problems in Amazon's system, Amazon mistakes mislead customers.

<comment><USER7> There's nothing wrong with Amazon's system, these people are committing fraud, it's illegal to submit a paid review without disclosing that the reviewer has been compensated.[0][1][2]

        ... The Guides, at their core, reflect the basic truth-in-advertising
        principle that endorsements must be honest and not misleading. ...

        In addition, the Guides say if there's a connection between an
        endorser and the marketer that consumers would not expect and it would
        affect how consumers evaluate the endorsement, that connection should
        be disclosed...

        OTHER THINGS FOR ENDORSERS TO KNOW

        Besides disclosing my relationship with the company whose product I'm endorsing,
        what are the essential things I need to know about endorsements?

        The most important principle is that an endorsement has to represent
        the accurate experience and opinion of the endorser:

            You can't talk about your experience with a product if you haven't tried it.

            If you were paid to try a product and you thought it was terrible,
            you can't say it's terrific.

Amazon's terms also forbid paid reviews [3]

        Who can create customer reviews?

        Anyone who has purchased items from Amazon.com. All we ask is that you
        follow a few simple rules (see "What's not allowed" below).

        ...

        What's not allowed

        ...

            Reviews written for any form of compensation other than a free copy of
            the product. This includes reviews that are a part of a paid publicity
            package

The comment I responded to said that the manufacturers may not have known. I simply pointed out the fact that, as stated in the complaint, some reviewers arranged to receive empty boxes so their reviews would appear to have come from a "verified" purchaser.

Amazon doesn't ship a lot of the items listed, many are merchant-fulfilled. Apparently some merchants were soliciting paid reviews and conspiring with those reviewers (by shipping empty boxes so there's a trackable package) to give those reviews more legitimacy. Again, without disclosure, that is illegal and against Amazon's terms.

The ability to have a 5-day, free download promotion is great for new kindle authors; it gives them a chance to receive legitimate reviews for their work. That doesn't translate to a problem with the system, rather a problem with some of the people using the system. That's what Amazon is trying to correct.

        "Amazon mistakes mislead customers."

Victim blaming?

I don't even know how to respond to that statement because it makes no sense. Are you saying that it's Amazon's fault that people are mislead (by illegal reviews) because they provide a review mechanism? If so, that's absurd.

[0] [https://www.ftc.gov/tips-advice/business- center/guidance/ftc...](https://www.ftc.gov/tips-advice/business- center/guidance/ftcs-endorsement-guides-what-people-are-asking)

[1] [https://www.ftc.gov/news-events/media-resources/truth- advert...](https://www.ftc.gov/news-events/media-resources/truth- advertising/advertisement-endorsements)

[2] (pdf) [http://www.ftc.gov/sites/default/files/attachments/press- rel...](http://www.ftc.gov/sites/default/files/attachments/press-releases/ftc- publishes-final-guides-governing-endorsements- testimonials/091005revisedendorsementguides.pdf)

[3] [http://www.amazon.com/gp/community-help/customer-reviews- gui...](http://www.amazon.com/gp/community-help/customer-reviews-guidelines)

</comment></comment></comment></comment><comment><USER9> Way to fight the easy fight Amazon. Didn't sue Fiverr of course, but sue 1k+ John Does? Don't want to invest a little into fixing your easily gamed, crappy ranking algorithm, but want to scare people off from gaming it instead? Priorities straight, not even once.

<comment><USER10> I have to wonder how effective this will actually be considering that Amazon's reviews are completely unmoderated, and explicitly open to the public.

The one thing I will credit Amazon with, is that they are quick to reimburse for fraudulent products when you can demonstrate that it is fraudulent. Quality might be slightly more debatable, but I would be willing to bet Amazon will reimburse on that as well.

</comment></comment><comment><USER11> The complaint is available here: [https://www.scribd.com/doc/285422882/Amazon- Complaint](https://www.scribd.com/doc/285422882/Amazon-Complaint)

</comment><comment><USER12> I will be watching this case with some interest, as I don't see what legal grounds Amazon could possibly have to sue these people. Reviews are free speech, and as such it will come down to whether or not Amazon can prove that these reviews, whether or not they were purchased, contain demonstrably false statements of fact (only then would these reviews be considered fraudulent by a US court). One cannot be sued over their opinion.

<comment><USER13> Commercial speech is not protected the same way as political speech. More importantly, there are plenty of laws against fraud. For example:

"Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both. If the violation affects a financial institution, such person shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both."

[https://en.m.wikipedia.org/wiki/Mail_and_wire_fraud](https://en.m.wikipedia.org/wiki/Mail_and_wire_fraud)

EDIT: A paid review isn't an opinion, it's an attempt to mislead for commercial gain. And civil suits are decided on a preponderance of evidence. As in 51% plausible. As in, a nudge more than a coin toss.

<comment><USER12> You are correct that there are laws against fraud. The issue is that the expression of one's opinion, however biased, cannot constitute fraud under US law. If there are _demonstrably false statements of fact_ in each and every one of the more than 1,000 reviews that they are suing over, then and only then will this lawsuit be successful.

<comment><USER14> The FTC regulates advertising with a much stricter scrutiny than free speech. There are few limits on what opinions you can express, but there are many limits on what you can advertise. I'm not saying that the FTC is involved in regulating online reviews, but the precedent seems to be set here. Especially given that these reviews are compensated, it seems clear to me that we're talking about regulation of advertising, not restriction of free speech.

<comment><USER15> In the US: [https://www.ftc.gov/tips-advice/business- center/guidance/ftc...](https://www.ftc.gov/tips-advice/business- center/guidance/ftcs-endorsement-guides-what-people-are-asking)

In the UK: [https://www.asa.org.uk/News-resources/Media- Centre/2014/Maki...](https://www.asa.org.uk/News-resources/Media- Centre/2014/Making-ads-Clear-The-challenge-for-advertisers-and- vloggers.aspx#.ViPE6NKrS01)

See, eg, [http://www.theguardian.com/media/2014/nov/26/youtube-ad- oreo...](http://www.theguardian.com/media/2014/nov/26/youtube-ad-oreo-banned- advertising-lick-race)

</comment></comment></comment></comment></comment><comment><USER16> So going along with the idea that misrepresentation of fact is fraud and you can be sued for it, does it mean that users who put a fake name in order to get free service in a freemium can be sued?

In that case, I would expect the answer is tighten up what you do as a company to make it not worth the time. That is the same answer I have for this situation. It should be on amazon to protect their review portal from false reviews, even non-automated.

</comment><comment><USER17> Four hours in and I don't see any comment here with the right take on it, so here you go: Amazon is not suing these 1,000 "John Does" in order to win, they're suing them in order to identify them and ban their Amazon accounts.

Once Fiverr is forced to divulge all the info it has regarding these people, Amazon will ban their accounts and drop the lawsuit.

<comment><USER18> That's a lot of money to spend to not follow through and put the last nail in the coffin.

<comment><USER17> What money? They have lawyers on payroll and filing fees are minimal. Their direct outlays so far in the three figures.

And I don't get what "following through" is supposed to mean? Trying to convince a judge that someone who got $5 for posting a review on Amazon encouraging people to buy from Amazon has damaged Amazon's business and should pay $XXX because of it? Multiplied by 1,000 defendants? That would be the laughable part. And that's the part Amazon won't be doing.

</comment></comment></comment><comment><USER19> I predict the whole thing will turn more black market and anonymous. Nothing will really change.

</comment><comment><USER20> > _Amazon gives anyone, whether they are customers or not, the ability to > review products sold on its online store._

Makes sense for books. Anyone know why this policy is maintained for products?

<comment><USER21> If you limit reviews to only Amazon customers, you limited the number of people who can write reviews. I buy a lot of things from other places as well, not just Amazon.

<comment><USER22> It's to the point where Amazon really needs to re-investigate this policy though. They have enough sales volume that they can limit to verified purchasers and still have plenty of good content. Quality would trump the quantity too.

That's just one of a dozen things Amazon _should_ be doing here though. We work with a few startups close to this situation, wow is it a mess.

</comment></comment></comment><comment><USER23> This is fantastic. Manipulating ratings is a big business, and it is good to see that Amazon is being aggressive toward this.

There was a time last year when they gave MediaBridge a rough time after they hired a lawyer to harass genuine reviewers. This is a much more proactive approach compared to Yelp, who is hoping congress passes anti-SLAPP laws.

If nothing else, this move may call attention to how much mischief is allowed in online ratings.

<comment><USER24> I am not opposed to what Amazon is doing on Fiverr. That said, I don't think you might be aware of the entire picture. Amazon itself is likely to be the very reason some sellers feel they have to play these games. See my post:

[https://news.ycombinator.com/item?id=10408396](https://news.ycombinator.com/item?id=10408396)

Unless you have at least a couple of years of experience dealing with Amazon from a seller's perspective it will be impossible for you (or anyone else, not focusing on you at all) to form an opinion based on all of the facts and nuances of the ecosystem Amazon has created. We get feedback from a large number of sellers we service with our management tools. Believe me when I say that the view from the seller's perspective is far, far less pristine than from the vantage point of Amazon buyers.

In a few words: For third party sellers being on Amazon can be a really fucked existence. A few have even gone bankrupt.

Again, not defending the wrongful purchasing of fake reviews but rather saying I understand precisely why some might feel the pressure to do something, anything, to save their businesses when going up against a mess of a system almost entirely rigged against honest sellers.

</comment></comment><comment><USER25> It seems like fixing reviews would be a good startup opportunity right? Any ideas what you would do?

<comment><USER26> Yes, definitely. My app suffered for years in Apple's app store against a competitor with an inferior product, but with high quantities of glowing "reviews". If Apple can't figure out fake reviews, and Amazon can't figure them out... then I'd say there is a HUGE opportunity here.

<comment><USER27> If Apple is not motivated to do it themselves, why would they use\buy a start- up?

Feels like a soft problem where Apple can do it badly and not feel any pain or see the needle move if they did it better. Mildly frustrated users won't leave because they have to climb over the garden walls.

<comment><USER28> Buying a start-up (assuming they already have proven the product) is much less riskier then building it in house.

</comment></comment></comment></comment><comment><USER29> Because reviews are used so heavily in the ranking algorithm, buying reviews on Amazon is like buying links on Google. Breaking the ranking algorithm potentially hurts their core business, so of course Amazon is going to take legal and other punitive actions.

It was only a matter of time.

<comment><USER30> The parallel between paid Google links and paid Amazon reviews is apt. Therefore, I do not understand the conclusion that Amazon is going to "take legal ... action".

Faced with link farms, Google penalized the beneficiaries in the search rankings; they didn't file lawsuits.

</comment></comment><comment><USER24> Amazon have created a system that is so one-sided and unfair in many ways that sellers could be pushed into resorting to pay for reviews.

BTW, notice I did not say "pay for positive reviews" but rather "pay for reviews".

Now, of course, one could setup something like a paid focus group where those who like the product are then encouraged to review on Amazon. That's not necessarily what happens on Fiverr. I am astounded at how blatantly some of these reviewers advertise on Fiverr. And, yes, Fiverr does look the other way. Not their problem. Well, at least not yet.

How is the Amazon system unfair?

Source/disclosure: I own a company that provides management services to Amazon third party sellers (A3PS). No, we have nothing to do with reviews yet we do see how the system works and how messed-up it is.

        - Bad reviews can absolutely tank product sales
        - No mechanism to protect from stupid or unfounded bad reviews
        - Negative reviews carry way too much weight
        - Amazon routinely removes positive reviews from listings
          without justification
        - Amazon never removes negative reviews
        - Review posters can use fake names
        - Search ranking is influenced by review score
        - Reviews are being used as business weapons
        - Amazon allows people who never bought the product to post a review
        - There are zero standards to control who can post a review
        - Buyers use neg reviews to extract frebbies

I won't discuss all of these in detail unless someone asks for clarification.

The first problem is that people who would post a negative review are far more motivated to do so than positive reviewers. This is common sense. Posting a review is a hassle. Motivation is important here. Someone who is unhappy about something --anything-- is far more motivated to take the time to post a review. And, in some product categories, dissatisfaction might have nothing whatsoever to do with the product.

This means that reviews are not a true representation of the product except in category-dependent corner or near-corner cases.

Example: Weight loss. Person buys an exercise widget. Doesn't use it consistently. Does not alter their diet. Three months later they've lost no weight at all and they are angry at something. They get an email from Amazon asking for a review. They lash out at the product. It feels good. In the process they've caused a situation for the A3PS whereby they might have to find dozens to hundreds of positive reviews in order to counteract the weighted average effect of that one utterly unfair negative review.

The review system treats weight loss pills and a screwdriver as though the review posting mechanics (motivation, satisfaction requirements, product-buyer relationships, effort required for success, etc.) are exactly the same.

That is just one example of the sort of thing that can drive sellers mad. There's real financial damage to sellers because of the ranking and in-page sales consequences of these reviews.

When someone says "reviews are being bought on Fiverr" the assumption is "positive reviews". The truth of the matter is that less-than-reputable sellers know full-well how deadly negative reviews are on Amazon. And some of them engage in attacking competitors with damming negative reviews.

Using simple math one can see the effects of bad reviews. The weighted averaging Amazon uses to calculate average review score has changed; for the purpose of this discussion I'll used the older and simpler version.

Say a product has 10 5-star reviews. They have a score of 5.0. Perfect.

If I now post 5 1-star reviews to that page the score goes down to 3.7. This is bad. It costs sales and ranking. My fake negative review served to damage my competitor.

How many 5-star reviews would it take for my competitor to repair the damage?

The answer is shocking: They need an additional 60 5-star reviews, for a total of 70, in order to get to 4.7, which would show five stars. Ranking would be affected less and buyers would see five yellow stars.

In order to get back to 5.0 they would need 500. Yes FIVE HUNDRED 5-star reviews for a rounded score of 5.0.

And that, right there, is one of the main issues with Amazon's scoring system. Anyone can post a review. Hire a bank of people in China, have them create fake accounts and start posting 1-star reviews on your competitor's products. You'll destroy them. Their sales with tank and they'll have no humanly possible way to recover their ranking. A minimal effort on the part of the attacker is remunerated with massive damage to their competitor.

The situation that is created is mathematically insurmountable. Someone with a great product and a perfect score would have to amass hundreds, if not thousands, of perfect reviews in order to counteract a negative review attack. This is, well, nearly impossible. And so, I can see how many sellers might be forced to resort to buying reviews in order to protect their business from attackers. The reward for attacking a competitor with negative reviews is massive, the cost is minuscule and the consequences are non-existent.

Amazon flat-out refuses to allow the seller to engage with buyers PRIOR TO a negative review being posted. In other words, something that is normal behavior IRL does not exist on Amazon. If you have a business IRL and a customer isn't happy with something you sold them they can either return it or talk to you to seek resolution. That's why Walmart and Best Buy have a Returns desk. People are serviced and everyone is happy.

On Amazon people get angry and post negative reviews. The seller isn't allowed an opportunity to connect with the buyer and make an attempt to resolve the issue. Perhaps the batteries were missing or the shipper broke the thing or the color wasn't to their liking. It would be sensible to allow the seller the opportunity to help buyers in this way.

Another horrible problem is that some buyers are very aware of the fact that sellers fear negative reviews. We've seen buyers ask for heavy discounts or 100% discounts "or else". In a lot of cases sellers choose to give in to the extortion because the consequences of bad reviews can cost them tens of thousands of dollars per month in sales.

We've seen cases where people post a 1-star review when the product arrived late. The review had nothing to do with the product. The seller was using Amazon for fulfillment. In other words, Amazon shipped the product and they screwed-up. Yet Amazon refuses to remove the negative review and the only way to counter it is to find dozens of positive reviews, which is nearly impossible.

In yet another case a seller got a 1-star review because they ordered three units and only received two. Again, Fulfillment-By-Amazon screwed up. The seller had nothing whatsoever to do with the act of picking, boxing-up and shipping the product. Yet Amazon rules do not allow this review to be removed and the seller would have to add dozens of 5-star reviews to fix the problem.

The Fiverr review jobs are not the problem, they are a symptom. One has to ask "Why are sellers compelled to pay for reviews?". The answer takes you straight back to Amazon. Sellers would have zero interest in reviews if the system was fair, manageable and couldn't be used as an offensive weapon by shady competitors.

I could go on for hours on this one...

</comment><comment><USER31> Wouldn't suing the businesses paying for the fake reviews, be more efficient?

<comment><USER32> It's harder to catch them.

It's pretty easy to comb through fiverr and pick off schmoes advertising fake reviews.

Identifying buyers is a different matter entirely.

I wouldn't be surprised if Amazon leveraged their position against the sellers to have them turn on the buyers.

I mean, how much loyalty is five dollars going to buy?

<comment><USER31> Maybe harder to detect but easier to prosecute. Also, the effect of a single convection is greater.

</comment></comment></comment><comment><USER33> Aren't most of these reviewers in third world countries with horrible legal systems?

<comment><USER34> It doesn't matter what their legal systems are like. The important thing is that they don't have any assets in Washington (nor anywhere else in the US, most likely). So when they don't show for trial, a default judgment will be handed down and any of the defendant's assets in Washington (none) will be seized to satisfy it. The first-order result of any such trial itself will be Amazon spending many thousands of dollars to obtain a handful of uncollectible judgments. Sometimes such judgments have value on the secondary market, but against a nonresident foreign citizen, forget about it. Presumably their true objective lies elsewhere, as others here have suggested.

</comment></comment><comment><USER35> Scummy move by Amazon, no surprise. They obviously don't care about the integrity of their core product as can be seen by the horrifically gamed reviews and the misleading third party sales system. Suing a bunch of people on Fiverr won't fix anything.

<comment><USER36> care to explain where the scum layer is here?

</comment></comment><comment><USER37> I don't know why amazon has to do this stupid (as others have pointed out on dubiously legal basis) crap - when they have lots of smart people, loads of user data and pretty much unlimited resources at their disposal.

It might be a hard to write an algorithm to distinguish shilled reviews from legit ones -- but it should be well within their competence.

<comment><USER38> Making a great algorithm _combined_ with suing the fake reviewers might be even better.

<comment><USER27> It certainly makes a headline unlike "we made a new algorithm!".</comment></comment></comment>


How to intercept Skype calls - <AUTHOR> http://www.scmagazine.com.au/News/258827,how-to-intercept-skype-calls.aspx "Researchers have discovered trick that allows encrypted VoIP calls like Skype to be deciphered without the need to crack encryption.
The method, dubbed "Phonotactic Reconstruction", exploited the Linear Predictive Filter, a system used by Voice over Internet Protocol platforms to transmit conversations by creating data sets from spoken English.
The researchers from the University of North Carolina said while you shouldn't ditch Skype, cryptographic system that leaked as much information as they managed to get are immediately deemed insecure. <comment><USER2> People seem to be misinterpreting the article, so here's a technical explanation:

\- Skype's encryption algorithm is not, itself, broken;

\- Skype uses a "prediction" algorithm to compress voice streams;

\- therefore, words have a specific pattern of bandwidth use (toy example: "techcrunch" spikes around the "-crunch", since you'd expect "-nology");

\- bandwidth use of encrypted compressed data is equal to bandwidth use of data that has only been compressed;

\- these patterns (which can be detected "through" the encryption) allow fairly good reconstruction of the voice stream.

If you like this kind of thing, Google "ssh keystroke timing attacks", or, more generally, "traffic analysis".

<comment><USER3> > Skype's encryption algorithm is not, itself, broken

Skype's encryption has not been _cracked_ , but it is broken in the sense that it preserves exploitable structure in the ciphertext. The ciphertext should be essentially random, shouldn't it?

<comment><USER2> The ciphertext _is_ "essentially random"; the _amount_ of ciphertext (per second) isn't.

Encryption will keep your wife from reading your letters, but if you send a hundred letters a month to the new girl at work she might still get suspicious. Encryption does not promise to prevent that.

<comment><USER4> unless you use _steganography_ to hide the existence of communication itself (see <http://en.wikipedia.org/wiki/Steganography> ).

<comment><USER5> Steganography doesn't hide existence of communication, it hides/obscures existence of messages in it. Important distinction.

<comment><USER4> Steganography hides the existence of covert communication. The message is hidden in an innocuous looking host (say a picture or video that noone would get suspicious about). So in that sense, the existence of actual communication is not known to a third party. I did a PhD theses on this topic :)

</comment></comment></comment></comment></comment></comment><comment><USER6> Original research paper: <http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf>

It's a facinitating piece of research, and a great collaberation between the CompSci and Linguistics depts of this University.

The title above is linkbait, as the paper is about analysing any variable bitrate audio stream. Mobile phones and enterprise VOIP solutions could be just as vulnerable. ]

<comment><USER7> It appears that a defense against this approach is to use a stream cipher with constant blocklengths. Does that sound like a reasonable interpretation of the paper?

</comment></comment><comment><USER8> I think they are saying that they don't need to crack the encryption due to the encrypted data containing patterns that still matched phonemes. It's basically a failure in the encryption for skype that the stream is not mixed up enough to avoid fixed patterns. Makes you wonder how long they have been decoding skype messages for intelligence reasons.

<comment><USER9> Forever.

When your moneysack is bottomless you can do anything, no need to decrypt it, man-in-the-middle it, if that cant do, switch the victims CPU for your own "special" one. Intelligence organizations have been breaking silently into peoples homes for hundreds of years, its a skill well developed. To then change a chip on your computer, is peanuts.

<comment><USER10> Geez, do you also wear a tinfoil hat, or was this humor?

<comment><USER11> Humor? The NSA tried to introduce an encryption chip[1] and get telecommunications providers to use it. It had a backdoor so that they could decrypt anything that used it.

I vaguely remember hearing other stories where chips were made with secret backdoors in them, but I can't seem to find any.

[1]: <http://en.wikipedia.org/wiki/Clipper_chip>

</comment></comment></comment></comment><comment><USER12> Its pretty intense research and one that is highly valued in the DoD world. They pay top dollar for this type of research and most likely did. If I remember correctly, they put out a call about 1 year ago for this type of "breaking" to be done on Skype. Mainly to listen to calls between suspects...

</comment><comment><USER13> A pretty clever attack. I wonder what the Skype people will do about it. (It seems like any algorithm that has e.g. a variable transmission rate will be relatively easy to attack.)

<comment><USER14> > It seems like any algorithm that has e.g. a variable transmission rate will > be relatively easy to attack.

Not really, just make the variability of bandwidth not depend on the amount of data that's being transmitted... i.e., add a stochastic factor to it (random). If there's enough noise, you probably shouldn't be able to decipher the words spoken.

</comment></comment><comment><USER15> Does anyone know if voice traffic actually passes through super-nodes, or are super-nodes just used for authentication, and punching holes through NAT? If it does, can you point to a reference stating this?

Anyway, billions of people have unencrypted conversations through this telecommunications system called the plain old telephone service. At least Skype is one step better.

<comment><USER16> _Does anyone know if voice traffic actually passes through super-nodes, or are super-nodes just used for authentication, and punching holes through NAT? If it does, can you point to a reference stating this?_

Yes, Skype traffic does pass through supernodes. I know people working on using Skype to route around censorship and supernodes allow you to connect two clients even if the direct connection between them is dropped. Here's an article in Skype about rate limiting if you're running as a super node which is further evidence that voice traffic _does_ pass through super-nodes. <http://forum.skype.com/index.php?showtopic=13780>

</comment></comment><comment><USER17> Using pattern recognition to guess words based on occurrence frequency is not a new concept, but the way they applied it is awesome. I saw something similar in Defcon 17 where the researchers recorded sound from a keyboard (using lasers as microphones, but that's irrelevant), then analyzed breaks in typing to attempt to guess what the victim was typing. Fascinating stuff!

</comment><comment><USER18> So... I need to make Skype calls with the water faucet and/or some music playing now?

</comment><comment><USER19> Even if it's possible to weaken encryption in Skype, it could be still strong enough and require a billion-dollar effort to decrypt a single conversation.

<comment><USER13> Have you read the article?</comment></comment>


Startup Quote: Larry Ellison, co-founder, Oracle - <AUTHOR> http://startupquote.com/post/4709587705

<comment><AUTHOR> Think of it as you want it, not as it is!

\- Larry Ellison

<http://startupquote.com/post/4709587705></comment>


Producers of Minecraft Documentary upload their new movie to The Pirate Bay - <AUTHOR> https://thepiratebay.se/torrent/7946763/Minecraft__The_Story_of_Mojang <comment><AUTHOR> My son (age 11) wants to be a game programmer because of his love for Minecraft. He talks about Notch as his hero.

I've setup a Minecraft server running on a headless box in my house. The server has a whitelist of about 20 names with my children's friends from school so they can play. It's running Craftbukkit/Spigot (<http://www.spigotmc.org/>) and Purugin (<https://github.com/enebo/Purugin>) which allows me to help them write Minecraft plugins in Ruby. Minecraft has spread like wildfire at their little school in the country, and being able to have their very own server that they are able to program and invite their friends to play on has made them micro celebrities at their school.

As a parent Minecraft is a way for me to engage with my kids on something we are all interested in. I am also teaching them programming on something they really care about. It's exciting to watch and be a part of, and this documentary will only fuel that growing passion to learn how to write code.

<comment><USER2> Hope you don't mind the plug, but I've been working on a Minecraft-inspired real-time cooperative game-making platform geared towards gamers (both young and older) and I think you might find it to be a great place to have fun with your kid, learning programming (Lua) and making actual games together, if you want to take it further. It's called CraftStudio and you can get it at: <http://craftstud.io/>

It's still in alpha (I've been releasing updates every few weeks for a bit over a year) but it's already capable of some very cool things. Videos of some games & creations made with it: [http://www.youtube.com/user/craftstudiodev/videos?flow=grid&...](http://www.youtube.com/user/craftstudiodev/videos?flow=grid&view=1)

Alternatively I know there are some great Minecraft mods like ComputerCraft (also Lua-based) which allow doing programmy stuff directly within Minecraft if you're so inclined.

<comment><AUTHOR> Thanks! I am always looking for ways to ween my kids off of consuming activities (eg. TV, most video games) and onto creating activities (playing Minecraft, programming, etc). I'll definitely take a look.

Would a Linux version be possible? I can't afford Mac systems for my kids, but they will both be getting Ubuntu laptops under the tree this year. I want them to wrestle with Linux because using the OS naturally leads you to learn about Unix.

<comment><USER2> Yup, the Linux port is in the works and I hope to have it available early next year.

CraftStudio is built in C# with XNA. I've been using MonoGame (<https://github.com/mono/monogame> \- open source, multiplatform reimplementation of XNA) for the Mac build for a few months and already got most of it running on Linux, I just need to find the time to get it into a releasable state.

</comment></comment></comment></comment><comment><USER3> Description for those who can't access the URL:

        Greetings Pirate Bay!

        This is 2 Player Productions here, and we hoped we could be the first to
        upload our new movie "Minecraft: The Story of Mojang".  We've never uploaded
        a torrent before so hopefully this isn't all screwed up.

        We wanted to come here first because we knew the movie would end up here
        eventually, and the best thing to do seemed to be opening a dialogue.
        Torrents and piracy are a way of life and it probably won't be going
        anywhere anytime soon.  There are many people that want to punish you for
        that, but we have a more realistic outlook on things.

        We've been there.  We've all needed to do it at some point.  Maybe you don't
        have the money.  Maybe you want to try before you buy.  Maybe you're pissed
        at us for premiering the movie on Xbox Live.  These are all fine reasons.
        But if you feel that piracy is, in Gabe Newell's words, "a service problem,"
        please consider that we are selling DRM free digital downloads that you can
        watch in whatever manner you please.

        We're just three guys trying to make a living doing what we love.  We love
        the world of video games, and we love making it real.  If you buy the movie,
        you support those efforts.  The reason we Kickstarted this movie in the
        first place was that we didn't have enough money to make it ourselves, and
        even then, we still put A LOT of our own money into it.  Not to mention
        nearly two years of work.

        Watch the movie.  Hopefully you'll like it, and understand what we're trying
        to do.  Please consider supporting us by buying the $8 DRM-free digital
        download of the movie at www.theminecraftmovie.com, or the $20 DVD from
        www.fangamer.net.

        We've worked with a lot of amazing people in the games industry and had the
        incredible fortune to make some great films the way we wanted to make them.
        Please consider helping us continue on this path.  The best has yet to come.

        -2pp

<comment><USER4> Really great stuff! Appreciate what 2pp is doing...

They also do an excellent job at filming the progress of the DFA (Double Fine Adventure)

<comment><USER5> If you are a backer of DFA, you can watch the Mojang movie on their private backers forum, it is being streamed, today (Dec 23) only.

</comment></comment></comment><comment><AUTHOR> The movie has an unobtrusive crawl around the 23 minute mark:

"Decided to pirate our movie, eh? Now you'll have to deal with these scroll-y bits. If you like what you see, buy the drm-free version at www.storyofmojang.com so that we can afford to keep making movies. Thanks!"

Very clever.

<comment><USER6> if the producers decided to upload this on a torrent, then they should not call me a pirate because I download it.

<comment><USER7> Why not? The producers shared that stuff on TPB because it'd end up there eventually, and because they understand that there are reasons for kind-of- sort-of-ethically-fine 'pirating'.

You grabbed the movie. You didn't got the payed version (otherwise you wouldn't complain) and got a reference to pirating. Because .. you pirated the movie.

They uploaded it to be in control on TPB. They explicitly ask for you to go ahead, check it and please support them by buying the movie. If you don't do that, you're pirating the movie with the help of the producers. At least in my world.

(Downloading it right now, net's slow. Will watch it with my wife and invest the USD 8 if it has a couple decent / funny / interesting scenes)

<comment><USER8> The moment the producer places the movie on pirate bay themselves and encourages you to download it, then it is no longer piracy, it is using torrents as a legitimate, distributed downloading service, like it was made to be.

If anything, they uploaded a shareware version of the movie to the pirate bay. Them saying you're pirating it is inaccurate. Instead it should be something like "Hey! I see you torrented our movie! Thanks for watching it; and if you feel like, please download the pay-for version of this movie to support us! (We'll even remove this ask for money from the official!)"

Piracy is, in the lazy short verison, acquiring without permission. Torrenting != Piracy when you have permission. e.g. every World of Warcraft update.

<comment><USER9> you assumed that putting their torrent on TPB is the same as giving you permission to download without paying.

<comment><USER8> How isn't it?

What is a valid situation where putting your video onto a website and then talking directly to the people you're marketing to in your video not giving them permission?

</comment></comment></comment></comment></comment></comment><comment><USER10> I watched this earlier (backed on Kickstarter) and it's fun to watch. There's no great insight into Minecraft and you won't come away from it knowing more about Minecraft or Mojang or why Minecraft is so successful, but you will see the personalities of some of those involved and things about the community and the things people have done. If you're a fan of Minecraft it's definitely worth watching (but it isn't a Minecraft equivalent of "Indie Game: The Movie")

<comment><USER11> I think 2PProduction's documentary of the development of the Double Fine Adventure provides more insight into game development. (You can still back them and get access to the episodes.) A lot of the very interesting things had already happened when they started filming the Minecraft documentary so it cannot provide the same deep look.

The Double Fine documentary is excellent. At this point I really care not one bit about how the actual game turns out, the documentary has been extremely rewarding. They really seem to show it all, warts and everything.

</comment></comment><comment><USER12> I'm confused. I can't hit the link because I'm in the UK.

They may have uploaded it to piratebay (would have happened anyway), but are they giving carte blance to download it however you like?

For example, since pirate bay is blocked here is it legal for me to search other torrent sites and download it from there?

<comment><USER13> I'm in the UK, saw the URL and I'm seeding the movie.

You need to change your ISP to one of the smaller ones, which will not just mean that your connection is unfiltered but also mean you're using (and supporting) diversity and increased competition.

<comment><USER14> OffTopic: Any recommendations for a small, good UK based ISP?

<comment><USER15> Andrews & Arnold is one of the best and most nerd friendly ISPs in the UK: <http://aaisp.net.uk/>

You can get a good idea of the company's general philosophy from their owner's blog: <http://revk.www.me.uk/>

Unfortunately they are quite expensive compared to the bigger ISPs but in their case you really do get what you pay for.

<comment><USER16> A&A are fantastic, yes they are a bit more expensive but they really do outshine every ISP in the UK with their no-bullshit attitude, and I love the way they take BT to task when things aren't 100% working properly.

I used A&A before I moved to Ireland and really miss them. I'm stuck with Eircom (there is virtually no land-based provider choice in Ireland if you live outside of Dublin) who are a financial basket case and suffering from virtually no infrastructure investment outside of Dublin.

Internet access in Ireland is like the UK was back in 2002/3 and the Irish government wastes millions of euros on half baked 3G/Wireless schemes that don't work instead of fixing the terrestrial system properly.

</comment></comment></comment></comment></comment><comment><USER17> [http://pirateproxy.net/torrent/7946763/Minecraft__The_Story_...](http://pirateproxy.net/torrent/7946763/Minecraft__The_Story_of_Mojang)

</comment><comment><AUTHOR> Really impressed that the producers will have a family-friendly audio track with the official, non-pirated version. My kids (ages 8 and 11) love Minecraft, and it will probably be the highlight for them this Christmas to watch the documentary as a family. I'll likely buy both the download version and the DVD when it's released on Sunday just to be extra supportive of their efforts.

<comment><USER18> Me too - I have had to explain a few off-color words from their viewing of fan videos on youtube.

"Dad is 'fucking retarded' a bad thing to say...?"

<comment><USER19> Imagine my parents back in 1989 when I asked them "What does 'cXXt' mean?" (I'd found it having opened up a text adventure I was stuck on in a hex editor, they had some naughty commands in there..!)

</comment></comment></comment><comment> matthew-wegner Rather annoying that you _can't_ yet buy the $8 version on their site. It's out tomorrow.

<comment><USER20> Agreed. I always like to support this business/distribution model (music/movie/comedy) when I can. I'll have to set a reminder to go back and pay.

</comment></comment><comment><USER21> I am currently downloading it, and I will buy 8$ download version just to support the guys, because they have guts to do something like this.

<comment><USER22> I am going to pay the $8 as well. I just wish I could give them my money now while downloading it via the torrent, but it is not available for purchase until December 23rd (tomorrow) on their site.

They should of put the torrent up on the same day it was available for purchase.

<comment><USER10> The film is already available to download to backers, I assume they're pre- empting the inevitable leak from a backer.

</comment></comment></comment><comment><USER23> The title is technically inaccurate; they've only uploaded the magnet hash to The Pirate Bay. Interestingly, they also haven't provided a license so I'm curious if anyone knows what the legal status of downloading this would be given that you'll be getting parts from people not licensed to distribute it.

<comment><USER24> I think it's clear that the producers consent to P2P distribution, given they knowingly made it available.

I don't plan on watching it — so I won't pay for it — but I will seed it because I'd like to encourage others to see it and pay for it. I think that's what the producers want.

<comment><USER23> It's interesting how this compares to projects posted without an explicit license where many will refuse to consider using the project until a license is specified:

[http://www.hnsearch.com/search#request/all&q=%22no+licen...](http://www.hnsearch.com/search#request/all&q=%22no+license%22&start=10)

[http://www.hnsearch.com/search#request/all&q=%22what+is+...](http://www.hnsearch.com/search#request/all&q=%22what+is+the+license%22&start=0)

</comment></comment></comment><comment><AUTHOR> It will be interesting to see if 2 Player Productions attempt to dialogue with those who would normally steal their work will succeed in actually converting many into customers.

</comment><comment><USER25> I'm downloading and will buy it if it is good enough (does not need to be great, just showing that the guys producing it does a good job). I really hope it is good enough :-)

</comment><comment><USER26> By and sky users can't access TPB, any chance of a magnet link?

<comment><USER27> magnet:?xt=urn:btih:41b2fd2403eba5a1dc23743fb08a15f968acc1b5&dn=Minecraft%3A+The+Story+of+Mojang&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftracker.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80

<comment><USER28> Interesting; this post has exposed a problem in the styling of HN, forcing horizontal scrolling.

<comment><USER29> This is an old, well-known issue. It just rarely occurs.

<comment><USER30> Actually it occurs every time somebody writes something long like this: xt=urn:btih:41b2fd2403eba5a1dc23743fb08a15f968acc1b5&dn=Minecraft%3A+The+Story+of+Mojang&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftracker.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80

It's unlikely it will be fixed though.

<comment><USER29> I mean "rarely occurs" in the sense that folks rarely post things with really long lines. Most of us have better sense than that.

</comment></comment></comment></comment></comment></comment><comment><USER31> Where can I buy it without the Pirate Bay Link?

<comment><USER32> www.theminecraftmovie.com

<comment><USER19> Except, bizarrely, not till tomorrow, especially given they say:

 _But if you feel that piracy is, in Gabe Newell's words, "a service problem," please consider that we are selling DRM free digital downloads that you can watch in whatever manner you please._

Ironically, this situation is a perfect example of a service problem, since I wanted to pay for and watch the film but have instead been presented with The Pirate Bay as an immediate solution. Oops.

<comment><USER33> Exact same thing happened to me. I wanted to pay for it, couldn't... So the only solution available to me is to download it from tpb.

Silly.

I'll pay for it tomorrow, but I wanted to pay for it now. This strategy doesn't make sense.

<comment><USER16> Oh c'mon, you do have a solution, exercise a bit of patience for 24 hours (if that). I bet most people complaining about this only found out about the film in the past few hours.

It's hardly the same as waiting for months before Dexter turns up in a format you want to pay for in your region.

Perhaps there is no strategy here, perhaps they just wanted a bit of extra time to make sure that their download and payment services were up to scratch so that there isn't a repeat of the JetBrains 75% off calamity.

<comment><USER33> True. I downloaded it yesterday and bought it today, but the point is -- the first time someone hears about something, it is in the best interest of the creator to make sure that person can pay the creator legally, otherwise that customer may simply not remember and never buy it when it is available.

</comment></comment></comment></comment></comment></comment><comment><USER34> I wish they had a bitcoin address!</comment>


Ask HN: Does YC accept non coders? - <AUTHOR>

What if you hacked together a few things that ended up looking like a startup and ended up giving a profitable first year yet some how you never wrote a single line of Code.  Would YC even be interested? <comment><USER2> Why would you be interested in YC? Once you're profitable, you don't need an accelerator. You also need to ask yourself why you need investment.

Is it because your profits aren't enough to help you scale? Or is it because you think that a normal lifecycle of a company involves accelerators, seed, A round, etc. etc.?

I'm genuinely asking you those questions, by the way.

<comment><AUTHOR> And here's my genuine reply:

I'm interested in YC because I believe the next step of our company is a platform instead of a service.

You're right, our profits right now are not enough to scale. We are living comfortably but really would rather rule the world instead of an apartment in L.A.

I believe there is no normal lifecycle. Every company/person has their own unique path.

<comment><USER2> I won't suggest ignoring accelerators _only_ because they give so little equity. At an early stage, it's wrong to think first about equity and then decide who you want to fund you.

However, I don't have enough info to say if you're at an early stage or not. If you aren't at an early stage, accelerators won't give you the bang-for-buck that they would for someone else.

You should first think about what you need (a certain amount of cash? industry connections? technical people? scaling expertise?) and then contact investors who seem to fit. If you're profitable and you have a take-over-the-world kind of idea, you could get money from pretty much anyone. The problem is that sometimes (not always) being post-revenue hurts your valuation, because it brings take-over-the-world conversations back down to earth. That may be changing these days for all I know, though.

Anyway, I'm sorry that none of that is very helpful. When, how, and from whom to get investment is more art/luck than science, and you'll get a different answer from pretty much everyone.

You should apply to YC if you think they can help. Couldn't hurt, right? TechStars seems to care less about founders being technical, so that's another route.

Edit: One more thing. Raising money takes a minimum of 6 months, and if it's not full-time work, it's pretty close. It may also involve travel. Make sure you budget time/money for the whole process.</comment></comment></comment>


Why 90% patents are crap - <AUTHOR> http://www.greyb.com/why-90-of-the-patents-are-valueless/ <comment><USER2> Yesterday during a design meeting somebody mentioned there are patents about uploading log files from a device we would be violating with a solution we had cooked up in 5 minutes. Totally insane.

Unless somebody comes up with a simple idea for determining whether a patent is real innovation I think we should give up on patents or make them very short term like 2 years for software. It would require changes to a lot of business models but I think in the long run we would be better off.

<comment><AUTHOR> Most of the software patents are crap. There is a patent on loading animation. Amazon has on one click payement. Apple has on slide lock. There is so much bullshit things in software patents. Then comes Pharma. Other than that, most of the industry file quality patents.

</comment></comment><comment><USER3> This article is clearly wrong, because it says 90% of patents are "crap".

The truth is that 100% of patents are crap. The whole system should just be abolished. All it does is give monopoly rights to huge corporations and prevent competition.

<comment><AUTHOR> No, you can go specific and say that 100% of software patents are crap but that is not true for every industry. Plus, until someone doesn't own a patent,he is an anti patent and the day he finds something worth patentable, he go to a court to protect it and yeah to defend it too when someone else infringes it. Then, he never thinks that let him use. There is difference in approach you know. Until you don't own one, you are always like this.

A patent, in essence, provides an inventor incentive for disclosing his invention. Nobody, otherwise, in this money centric world would be spending billions in R&D to invent something if there is no incentive in that.

Saying that 100% patents are crap isn't a good thing, I believe. You can once give it another stance; by not looking at it through software lens alone.

Try once.

<comment><USER3> No individual can own a patent and successfully defend it in court. The barrier to entry is too high. Patents only benefit corporations which use them to prevent competition from smaller companies which can't afford the legal costs of patent battles.

If you're in favor of patents, then you oppose small business, and you want to live in a world ruled by oligopolies.</comment></comment></comment>


The Rare Workers Who Thrive on Negative Feedback - <AUTHOR> https://www.wsj.com/articles/the-rare-workers-who-thrive-on-negative-feedback-1536672180 <comment><USER2> Very interesting, I think I'm that person :)</comment>


Not Danga - <AUTHOR> http://brad.livejournal.com/2358774.html <comment><USER2> I don't know what the heck that was about but I'm pretty sure it doesn't belong here.

Where's the _mod article down_ feature when you need it?!</comment>


Show HN: College roommate matching service [BETA] - <AUTHOR> https://www.meetroomie.com <comment><USER2> It would be nice to know what this does without having to sign up (confirmation email takes forever) and fill out the questionnaire. The users all have stock photo profile pictures. And to do literally anything (message or view profile) I have to pay.</comment>


Poll: What to buy? - <AUTHOR> https://docs.google.com/forms/d/1hlNagdKvLU-zHEd2xdCfbx5RxNKtMl12plVXLUGZkyM/viewform

<comment><USER2> is this 4chan now?

<comment><AUTHOR> I thought validating an idea is very common step for startups?</comment></comment>


Ask HN: How are you using AWS to serve and scale your web app? - <AUTHOR>

Which Amazon Web Services products are you using and what is your setup?
Do you scale your EC2 instances horizontally or do you find you can handle most bottlenecks by moving to a bigger instance?
Do you put your db in EBS, RDS, or just use EC2 storage? Why do you or do you not use RDS? How do you handle backups?
How do you share user uploaded files between web server instances?
Thanks! <comment><AUTHOR> I have used AWS on 2 projects now.

On the first project, we used 2 small instances as web servers, 1 small instance as a database master, and another as a slave. The slave machine handled backup of db and uploaded files by zipping everything up and throwing it onto s3. There was no EBS or RDS at this time. The main problem we had was sharing user uploaded files between instances. We used Gluster (<http://www.gluster.org/>) for this, but it was complicated and gave us problems. In general this setup worked fine and we could add webserver instances to handle traffic spikes. Even this limited setup took a bit of effort to maintain and I often wondered if we could have just handled the whole thing with one large or extra large instance. Does anyone know if there is some bottleneck that comes from vertically scaling like this?

Sadly, on the second project we haven't really needed to scale at all, so we just use one small instance for everything and have our mysql files and user uploaded files in an EBS volume. I haven't really figured out backup and restore from snapshots yet, so I just zip up the contents of the EBS and transfer it to S3. We are using cloudfront to serve static files and it seems to work fine.</comment>


The tiniest C sort function? - <AUTHOR> http://www.cs.dartmouth.edu/~doug/tinysort.html

<comment><USER2> Why the hell is recursion considered cheating?

<comment><USER3> Use of recursion isn't the part that's cheating. It's that the recursive function uses a dummy argument to avoid allocating a temporary variable so it doesn't have the same signature as the other functions and it requires the caller to allocate space for the dummy variable.

</comment></comment><comment><USER4> So people is this really the tiniest?

</comment><comment><USER5> I much prefer readable code.</comment>


Getting to "Yes" for Corporate Innovation - <AUTHOR> http://steveblank.com/2015/03/17/getting-to-yes-for-corporate-innovation/

<comment><USER2> So what's a good approximate metric for the possible damage if something does go wrong? Some function of fixed operating costs and customer turnover? Driving away a customer that you'd expected to keep for another 10 years is a bit different than if you'd only expected to keep them for a month, and losing half your customer base is a bit worse if your fixed costs are 80% of revenue vs if they're 20%.

The example had two cases, at opposite ends of this. Are there generally accepted not-too-heavyweight ways to calibrate procedures for cases that are more in-between?</comment>


Container Solutions Releases New Container Tech - <AUTHOR> http://container-solutions.com/2015/04/container-solutions-introduces-rocker/

<comment><USER2> Genius</comment>


Three Architectures for a Responsive IDE - <AUTHOR> https://rust-analyzer.github.io/blog/2020/07/20/three-architectures-for-responsive-ide.html <comment><USER2> The fun thing about how Sorbet works: the same architecture that powers parallel execution (for batch speed ups) is the thing that powers fast, incremental IDE mode.

[https://github.com/sorbet/sorbet/blob/master/docs/pipeline.m...](https://github.com/sorbet/sorbet/blob/master/docs/pipeline.md)

^ This is a picture of Sorbet's batch pipeline.

The columns represent parallel execution (at the file level). The three big boxes represent fork and join points. So for example, the first large box (index) and the last large box (typecheck) are trivially parallelizable at the file level, and there's a small, tightly controlled resolve step that can't* be parallelized.

But it's also a picture of Sorbet's IDE pipeline, where the columns represent incrementality. If no other file (column) changed, that work is already cached.

This keeps things really simple because:

\- Most speedups make both the batch mode and the incremental mode faster

\- The same code paths are 100% re-used between the batch mode and the IDE mode

\- Bugs that are "IDE-only" are rare. You can almost always reproduce a bug in the IDE mode as a bug in the batch mode if you squint at the problem hard enough.

The article says something like this:

> The main drawback of this approach is that it works only when it works — not > every language has a well-defined FQN concept.

Sorbet was designed from the very beginning to support a type system for Ruby that wasn't maximally expressive nor maximally faithful to existing Ruby code. It was designed to make editor tools super easy to build and maintain. There are plenty of places where this shows through to the user in not great ways, but the benefits of a fast, reliable IDE mode generally out shine them.

*: This doc is actually out of date; there are ways to parallelize parts of it that have been implemented.</comment>


Temple, Read and annotate the popular religious texts - <AUTHOR> http://temple.io/?ref=

<comment><USER2> Why do so many sites use Raleway font. I get that it is free on google font, but it is very hard to read. You want to be elegant? get a real font or UX designer.

</comment><comment><USER3> Really? Submitting something less than 2 hours after the author posts a "Show HN"?

[https://news.ycombinator.com/item?id=9560269](https://news.ycombinator.com/item?id=9560269)</comment>


Why Big Tobacco and Big Vape love comparing nicotine to caffeine (2019) - <AUTHOR> https://www.theverge.com/2019/4/26/18513312/vape-tobacco-big-companies-nicotine-caffeine-comparison-drugs-chemicals <comment><USER2> > But nicotine and caffeine aren't chemically similar, not really. When I > covered the health effects of nicotine last year, I asked Adam Leventhal, > director of the USC Health, Emotion, and Addiction Laboratory, how the two > drugs compared. "They're apples and oranges," he told me, citing a long list > of distressing caffeine withdrawal symptoms like anxiety, depression, > irritability, and hunger.

Oh whups. I made a typo there. Can you guess which word?</comment>


DigitalOcean Cloud Hosting Review - <AUTHOR> http://codecondo.com/digitalocean-cloud-hosting-review/#do

<comment><USER2> Really great review! I signed up to DO at the weekend and really impressed with how quick it was to get everything up and running!</comment>


Groupon is now threatening small merchants with lawsuits - <AUTHOR> http://venturebeat.com/2012/08/20/groupon-is-threatening-small-merchants-with-lawsuits/

<comment><USER2> Be sure to read the fine print from the author: "(Disclosure: I have various puts and wagers against Groupon.)"

<comment><USER3> Yeah, I've read a bunch of stuff from Agrawal before - his criticism of Groupon isn't particularly new. I'm not saying that his issues with it aren't legitimate (I don't really disagree with anything that he's saying), and his stance against Groupon is probably motivated by conviction rather than profit (he's made a great case for this on Quora at [http://www.forbes.com/sites/quora/2012/04/06/is-it- ethical-t...](http://www.forbes.com/sites/quora/2012/04/06/is-it-ethical-that- rocky-agrawal-is-criticizing-groupon-while-simultaneously-owning-a-short- financial-position/)), but it would be a lot easier to accept these types of things from someone without a horse in the race IMO.</comment></comment>


Greengrass – Ubiquitous, Real-World Computing - <AUTHOR> https://aws.amazon.com/blogs/aws/aws-greengrass-ubiquitous-real-world-computing/ <comment><USER2> $1.49 per device per year is very expensive for what amounts to library that is designed for vendor lock-in. In a market where there is a drive to push down the cost of devices, $7.50 (5 years) over the lifetime of the device is a substantial cost. And, unfortunately, it won't run on all your devices, only the high-powered ones, so you have to solve the problem on your own anyway for a full breadth of devices.

<comment><USER3> > only the high powered ones...

That's what I noticed...

"Greengrass Core is designed to run on devices that have at least 128 MB of memory and an x86 or ARM CPU running at 1 GHz or better."

Those are beefy specs for IoT.</comment></comment>


Alan Turing papers on code breaking released by GCHQ - <AUTHOR> http://www.bbc.co.uk/news/technology-17771962

<comment><USER2> Did the Brits publicly apologize for what was done to him yet?

<comment><USER3> Nope. Would you excuse/apologise everyone who was prosecuted under that law or just make a special case for Turing?

I too believe what happened was wrong but if you start apologising for some of the old laws which now seem completely backwards... where does one stop?

</comment></comment><comment> excuse-me >A GCHQ mathematician said the fact that the contents had been restricted "shows what a tremendous importance it has in the foundations of our subject".

It probably shows that nobody with the authority to clear them for release understood them and it was safer/easier to just stamp restricted and let somebody else worry about it in another 30years than admit it.

It's pretty much a safe bet that, even within GCHQ, anybody with any seniority in the British civil service will have no technical background.

<comment><USER4> > _It's pretty much a safe bet that, even within GCHQ, anybody with any > seniority in the British civil service will have no technical background._

A tricky question to answer. Most of what they do is secret, and people don't talk about the work at all.

It's not necessarily a bad thing to leave people good at the job doing the job and let people good at managing doing the managing.

But look at, for example, mathematician Clifford Cocks who (it's safe to say) is a good mathematician and is in a position of seniority with GCHQ and possibly other research partnerships such as the Heilbronn Institute.

(<http://www.maths.bris.ac.uk/research/heilbronn_institute/>)

<comment> excuse-me > leave people good at the job doing the job and let people good at managing > doing the managing.

In my experience of UK military/security service there is a boffins + officers divide attitude all the way up.

Above any level of required knowledge it moves into the Oxbridge/PPE/civil servant mindset - it shouldn't take too much imagination to realise that these people aren't necessarily hired for the brilliance in management.</comment></comment></comment>


After a month on a cash diet, here are my best money saving tips - <AUTHOR> http://www.cnbc.com/2017/01/27/after-a-month-on-a-cash-diet-here-are-my-best-money-saving-tips.html <comment><USER2> I've quit my job twice now to make huge Overland trips (AK->Argentina, now around Africa for two years), all funded by saving money. The tips in this article are good, though I would go much, much further.

My biggest advice is not to think in terms of dollars when looking at a price tag - think in terms of the number of hours of your life you are spending to purchase something. Once you calculate your "real" salary (taking into account taxes, commute expenses, etc. etc.) it turns out you have to sit at work for a LOT of hours to afford a big screen TV. All of a sudden it's not so attractive, and it's easy to not buy one.

Extend that across all spending, and soon you really won't be spending much at all.

I'm so passionate about helping other people do it I even write an e-book on the topic - Work Less to Live Your Dreams[1]

[1] [http://amzn.to/2kyrCM3](http://amzn.to/2kyrCM3)

<comment><USER3> It's like $300 for a big TV. Not the very best one of course.

I guess 50 hours can still be a lot though.

</comment></comment><comment><USER4> For folks here, I like ledger-cli (and that family of tools) over excel.

1) It's designed for tracking finances.

2) It's plaintext so amenable to scripting and custom reporting using any of your favorite tools and languages.

3) It's reporting system is quite capable and paired with tmux and emacs I have a nice homemade financial dashboard. On one pane is an emacs instance for data entry. In others are various reports executed using watch. If you include stocks and other investments, you can use a pricedb file and have an up to date (set mine up for daily price downloads) view of your entire financial portfolio.

EDIT: I was on mobile earlier.

Ledger link: [http://www.ledger-cli.org](http://www.ledger-cli.org)

Plaintext Accounting: [http://plaintextaccounting.org](http://plaintextaccounting.org)

Paired with org-mode with custom PENDING/CLEARED todo states and noweb/tangle of babel code blocks, you can make a pretty effective workflow without much effort. And I prefer this over automated trackers like Mint or something where it's easy to ignore it for a few days and still have correct information, but not know where your money went. (I do use Mint, it's a convenient place to get aggregated data from the half dozen or so institutions holding different parts of my assets or debts).

</comment><comment><USER5> Articles like this are helpful for some ideas. However I disagree with the methodology used(mandatory shopping list, cash only...), although maybe it works for impulsive people.

It's good to have a shopping list and to be conscious of your wealth/income. However in my opinion the best tool is have a set of principles.

Thinking only about money will often fail you. It's better to think: Given my requirements what is the most cost effective product? You probably don't want to waste time having to fix bad quality items, or going to work with a dirty shirt because your detergent is worthless. Or buying a cheap thing to realize that it was crap and having to buy the expensive product later on anyways(after having lost the money you put on the cheap thing).

On some products, like tools or a car, you should ask yourself: Will this product ever let me down? How long will it last? A lifetime? Keep in mind that pricey products can be good deals too.

On commodity goods spend less, on everything else spend smarter.

<comment><USER6> I'd say there's a time and place for cheapest-possible, and for buy-it-for- life quality. I own a bunch of cheapest-possible tools that I bought when I was younger and poorer and just starting out on my own. The tools have been useful and allowed me to repair stuff around the house so they've definitely improved my life, but they won't last forever.

As they break or wear out over the years, I'm slowly replacing them with top- quality stuff. However, I would NOT have wanted to "buy it for life" when I was first starting out (even if I could've afforded it), because I didn't know my own long-term needs well enough to predict which tools I'd actually need and use often, and what features I'd want in them.

If you buy good quality stuff that's actually the wrong stuff for your needs ("why do I even own this band saw that I never use?"), it doesn't matter how good the quality is -- it's still wasteful. So I'd say there can be a time and place for the cheapest possible thing -- and hey, my $5 yard sale circular saw is still going strong after all these years, even if it makes a burning smell....

<comment><USER7> I like the ~$10 USD toolset from Ikea. It includes a hammer, multi-tip screwdriver, adjustable wrench, and a pair of pliers. For 95% of the tool- needing things I do around the house, these tools are sufficient.

<comment><USER8> And for typical houshold use thy last years and years.

</comment></comment></comment></comment><comment><USER9> Well the sad and simple way:

\- Food: Go to the cheapest store that still has normal vegtables, cook for yourself whenever possible, don't buy overly expensive stuff like avokados or good cheese.

\- Transportation: Bike/Foot

\- Bakery/Concerts/Vacation/Cinema/Bars/mobile-internet etc: don't

\- Accomodation: shared

\- Other necessities: only buy when broken, google for 3 hours to find the cheapest thing that won't break all too easily or go 2nd hand. Save at least 1000 bucks in case something big like your laptop breaks.

<comment><USER10> I feel like I've saved enough money going vegetarian to afford the good cheese and avocados. (I'll never quit dairy. That's a quality of life thing for me.)

<comment><USER11> if you leave a cow to cow it will cow for 20 years

dairy industry cows only live for four

[https://en.m.wikipedia.org/wiki/Dairy_cattle](https://en.m.wikipedia.org/wiki/Dairy_cattle)

</comment></comment></comment><comment><USER12> This is similar to Dave Ramsey's advice on spending money. Here is Megan McCardle's experience here: [https://www.google.com/amp/www.theatlantic.com/amp/article/3...](https://www.google.com/amp/www.theatlantic.com/amp/article/30391/?client=safari)

<comment><USER13> Native link:

[http://www.theatlantic.com/business/archive/2009/11/forgive-...](http://www.theatlantic.com/business/archive/2009/11/forgive- us-our-debts/30391/)

not paywalled as far as I can see.

</comment></comment><comment><USER14> I don't understand how credit card implies going into debt for many people. I pay mine off every month and all is good. It would never occur to me to leave a balance and pay 20% or whatever interest.

<comment><USER15> As a European I don't underdtand why people are actually using credit cards. Over here, most people just buy stuff in stores with their EC card (which should be similar to a debit card in the States?). This way I can't spend money I actually don't have and I don't have to take care of any monthly balance.

<comment><USER16> In the US, it's a combination of factors. Personally, I receive unlimited 2% cash back with my credit card, which is enough of an incentive for me to use it wherever I can. In addition, it helps me build my credit score, which is a system that has a lot of issues but is not one I'm in a position to ignore. I don't know about the situation in Europe though, are there similar benefits for non-credit cards (debit cards), and is the credit score system as important?

<comment><USER14> The credit system is not important. When I came to the US I didn't even know what "building credit" means. To me being creditworthy meant not to have debt.

<comment><USER4> Sufficient (positive) net worth definitely makes someone creditworthy. But, most borrowers aren't leveraging major assets like companies or investors or others might. What they're leveraging is their future earnings. "I need $10,000 today to buy this car, and over the next 3 years I'll pay it off at X% interest." Having a history of using credit effectively in this manner (paying it off on time being the big issue) is the only way that someone without a significant (positive) net worth can demonstrate to a lender that they're creditworthy.

</comment></comment></comment></comment></comment><comment><USER17> I racked up $25K of credit card debt by not tracking my spending and then building up so much fear around my finances that I was afraid to check my accounts.

While the tips mentioned are solid, some people need more extreme options.

My "diet" involved four months of sleeping in the woods, naming porn flicks for cash, selling other people's restaurants (no license necessary), and giving up alcohol and eating out.

Too extreme for most? Yes. But if you're single / have few responsibilities (i.e., young millennials) it might work for you.

I wrote a step by step book on this subject called Debt Destroyer: [https://www.amazon.com/Debt-Destroyer-Achieve-Financial- Free...](https://www.amazon.com/Debt-Destroyer-Achieve-Financial-Freedom- ebook/dp/B01N31SZD2/ref=sr_1_5?ie=UTF8&qid=1485895333&sr=8-5&keywords=get+out+of+debt)

</comment><comment><USER18> I wonder, in the long run, how sustainable something like this is in the long run. Take food, for example - one can go without it, or eat nutritionally poor stuff for a few weeks, probably without major effect. But it seems like optimizing for money means it will eventually take its toll - and that could lead to problems in the long term.

(A single copay could eat half a week on this system.)

<comment><USER3> There's not really all that much correlation between the cost of food and the nutrition it provides.

</comment></comment><comment><USER19> "Cash diet" instead of "budget"? Really? Has HN turned into the supermarket checkout aisle?

<comment><USER20> Withdrawing a fixed amount of cash per week is one of the tricks mentioned in the fine article.

I can confirm that it works very well (in fact it's the only thing that has ever worked for me).

<comment><USER7> I dislike making special trips to the ATM, and carrying around bucket loads of coins in my pockets., so I took the opposite approach.

I put my weekly expenses on a single credit card, with the caveat that I have to pay it off every week. I have a small savings account into which I set aside cash for fun things. If my weekly credit card bill is over the limit, I have to take the money out of my fun savings account, which I don't like doing, so I somehow mentally naturally find a way to spend less to avoid dipping into savings. It took me a few weeks to get used to it, and now it works great.

Another advantage s that my intermittent expenses which require a credit card, such as Lyft rides and refills on my pre-paid public transit card, now appear of the same credit card as my trips to Chipotle & Walgreens.

</comment></comment></comment><comment><USER21> $60/week isn't bad, though I'm not sure quite how that is in NYC. In the Chicago suburbs I feed two of us on something around that level (including the TP as well), and that's with dietary concerns as well.

A lot of how much you can save like this depends on your situation. If you have storage space and decent cooking facilities, it's a LOT easier because you can have some reserve to allow you to take advantage of economies of scale and opportunities like that 20 pound bag of rice on sale for $6. Similarly, if you have a full-size refrigerator and freezer you can pretty easily make a week's worth (or more) of meals to take to work.

It's also important to have a good grasp of how much each individual meal costs, because you may realize that some less-expensive options may actually be preferable. That gluten-free bagel plus cream cheese? That's $1.50+, or would you prefer oatmeal, a couple of breakfast sausages, and a couple of eggs over the top of that? That easily clocks in at under $1, including with your choice of rolled or steel-cut gluten-free oatmeal (and if you don't care about gluten it's even less), and it takes almost no extra time in the morning over toasting and cheesing a bagel if you've pre-made the oatmeal. It's worth not getting carried away with this though - for some things it's just worth getting the more expensive option because making it at home takes more time or energy than you want to spend.

Knowing your cost of getting things is also important - don't drive 5 miles to save $0.50 on milk, because you're spending that much extra on gas. This is where shopping lists are important, as well as having a good feel for typical prices at different stores if you have multiple shopping options. If you know you're doing your shopping for the week at a store the cost of getting there is less of a factor, and conversely if you know cost of getting there is a concern then you'll want to avoid forgetting something that you have to run back out for (hence the list).

Finally, if you can stockpile some things and have multiple shopping options it's well worth keeping an eye on sales flyers and per-store discounts. Using myself and Meijer as an example, in January so far I've saved $12.34 using electronic coupons through their "mPerks" app and another 6.25 using paper coupons (either printed at checkout or on product packages, I'm not a couponer), plus $47 off of the regular prices of items by getting them when they're on sale - and I've only spent $128 there so far this month. I rarely buy items just because they're on sale, so that's almost all savings on items that I'd have been purchasing anyway.

</comment><comment><USER22> another one: Before buying ask yourself: "Do I really _need_ this item or do I just _want_ it."

<comment><USER23> This. I want a new car, but I don't want to give up my cash reserves to buy one, nor do I want a new car payment. My 10 year old car gets me to work, so I keep on driving it and probably will until the wheels fall off.</comment></comment>


Getting started with login verification - <AUTHOR> https://blog.twitter.com/2013/getting-started-login-verification

<comment><USER2> Oh, good grief. The 2FA options just showed up for me on Twitter.

You check the checkbox, and it sends you a text message. And then, rather than asking you to type in the message you received (you know, like any sane 2FA setup would do, to ensure it's working), it just asks you if you received the message. If you click "Yes", then it turns on 2FA. Without, you know, actually verifying that the user received a message.

People don't read dialog boxes. They're just going to click the blue button to get the popup out of the way. I expect there will be plenty of people who manage to lock themselves out of their accounts in the near future.

Literally every other 2FA activation everywhere goes something like this:

 _1\. Set up verification_

 _2\. Enter the verification code that you see so we can be sure that what you have matches what we have_

 _3\. Yay, you're protected with multi-factor authentication and haven't locked yourself out of your account!_

Twitter's setup is more like:

 _1\. Check a checkbox and click a button_

 _2\. If you didn't actually read the message and verify that you received a generic text message from Twitter, you are now locked out of your account._

Let's not even touch the fact that they didn't add backup codes, Google Authenticator support, and that you have to be in range of a cell tower to log into Twitter with this on now. It's not like mobile number porting attacks have been used to compromise SMS-based 2FA solutions or anything, or that high-profile Twitter users are being targeted by spear phishing attacks.

It's better than nothing, but I'm really kind of put off by how much of an afterthought this seems to be.

<comment><USER3> Wait, SMS does not have a delivery guarantee, right? How can they implement a reliable 2FA system on asking the user if they received a text or not?

<comment><USER2> They _can't_. That's my point. If they would text you a code and ask you to enter it, then they can infer successful delivery. They don't do that, which means that you can turn on 2FA against a phone number you don't own and completely lock yourself out.

Better yet: They don't have any concept of "trusted devices", so you have to do the 2FA dance _every time you log in_ regardless of whether you've 2FA authed on that device before or not. This means that if you've lost your phone and your desktop session has expired, you can't get back in to turn 2FA off, again meaning that you're completely locked out.

<comment><USER4> I think if they had a concept of devices to permit "trusted devices", they'd also have a way to do "has already seen this notification on one device, so don't display it as new on other devices".

Twitter must really be a disgusting mess architecturally; they have a decent number of competent employees, so it's hard to imagine things like this persisting otherwise.

<comment><USER2> Not really; you can just set a cookie that indicates that the device is trusted for 2FA. It's no more damaging than a session cookie if hijacked, can be protected by TLS, and doesn't require any special server state.

On first login:

Login sends credentials, no cookie. Provider verifies credentials, doesn't have 2FA verification, sends 2FA challenge. Upon completion of challenge, provider sets session cookie + 2FA cookie.

On logout, the session cookie is destroyed, but the 2FA cookie is not.

On successive logins:

Login sends credentials + 2FA cookie -> provider verifies credentials, verifies 2FA cookie + timestamp, grants a session cookie.

This way, you can gain the power of 2FA (someone stealing my credentials won't be able to log into my account) without the hassle of it (people using stolen credentials won't be logging in on my own computer, so I can trust this computer to bypass challenges for 30 days), and you don't have to add any server state that is aware of any particular computer, save for some value which is tied to the cookie. For bonus points, the server maintains a list of 2FA cookie tokens, and allows them to be revoked, so if my laptop is stolen, I can log in on my desktop, revoke my laptop 2FA cookie, and the 2FA bypass won't work from it anymore. Slightly more work, nothing really significantly difficult, but substantial increase in usability without any real sacrifice of security.

<comment><USER4> For webapps, yes, but I'm not sure how they could do it that easily with iOS integration. I'm pretty sure Twitter views iOS/Android as much more important than web.

(although, most of their hacking/account hijacking probably happens over non- mobile. If they had a way to improve web login security and strongly separate out mobile integration logins to use a weaker system, that would work too. Although I think it wouldn't be too hard to present to Twitter as a mobile client when you're really a fuzzer or attack script.)

<comment><USER2> You don't typically lose sessions on mobile devices, though. Repeating the 2FA cycle on them isn't nearly so inconvenient as it is in a web browser.

</comment></comment></comment></comment></comment></comment></comment><comment><USER2> So, experimentally, I've discovered that this makes Twitter accounts subject to DOS attacks. Codes are taking ~70 seconds to arrive right now for me. If I have your username and password, I can just keep logging in with them and having it generate new codes, which invalidates any previous codes. As long as I keep attempting to log in, you will be prevented from logging in since the latency to receive the SMS code is greater than the time it takes me to attempt another login, thereby invalidating the code that will be received.

Wow.

This also means that I can either a) flood you with text messages, or b) trip some threshold that will prevent Twitter from sending you text messages. In either case, a clever attacker who has the username and password could use this to cause a lot of grief for an account holder.

(This is, by the way, yet another argument for device-based TOTP.)

<comment><USER5> But, this grief is still less than the grief if they'd go through if they didn't have Two Factor Authentication enabled, no? Yes, DOSing and SMS spam sucks, but not nearly as much as having your account successfully hijacked.

<comment><USER2> Certainly, but you can have 2FA _and_ not have a DOS vector if you provide TOTP.

</comment></comment></comment><comment><USER6> No Google Authenticator support though. No list of backup passwords either. So if I lose SMS access on my phone, but still have my phone, I still can't get into an account from a new device.

<comment><USER7> I'm very disappointed they don't have Google Authenticator (or maybe some custom HOTP/TOTP app) support.

And I imagine Twitter thought of the lost phone/sim card problem, is there really no set of preshared backup keys?

<comment><USER6> I'm guessing they just wanted to get this out the door quickly.

You get app specific passwords, but they're only good for an hour. By then, your app should have a token that is good indefinitely (and you can revoke from their apps list).

<comment><USER3> How much more time would it have really taken them to get TOTP out the door? I mean, a toy implementation only takes a few minutes... I get that the scale is completely different and they would need to audit all of their systems, but how long have they been working on this already? I can't imagine they only got the idea that maybe 2FA is a good idea last month. They probably have spent months on this already; had they wanted it from the beginning, would TOTP have really delayed anything?

<comment><USER8> Exactly. I really can't see a full-blown SMS system taking less time to integrate than TOTP.

</comment></comment></comment></comment></comment><comment><USER9> I wonder why they decided to send codes over SMS that we have to manually type into a browser instead of a one-tap push notification to the Twitter app on the phone? Or Google Authenticator?

<comment><USER2> SMS is a great option since it supports people with feature phones. But, IMO, SMS should be a fallback, rather than the primary option, since it is network- reliant and subject to a number of attacks that app-based authentication is not subject to.

<comment><USER10> Couldn't agree more.

I'm not using SMS on any of my 2-step-auth services because I don't want to be locked into owning that phone number (and worry about roaming charges if I travel).

Google Authenticator or similar apps are my first choice.

</comment></comment></comment><comment><USER4> I've been waiting for the SMS for 45 minutes to no avail :( I wonder if it's just load problems on their side.

I really hate SMS-from auth, anyway. Now my cellphone-provider account is security critical, rather than my installation-of-a-secure-client-I-control. This is some protection against mass attacks on Twitter, but I use a long, unique, random string as my passphrase, so I'm not too worried about that.

Kind of sucks that Twitter has such light security compared to FB/Google/AWS. I guess they're substantially smaller, but this wouldn't be that hard for 1-2 good engineers to get right. If it weren't for the stupidity where Google/Apple/Twitter/Facebook/Amazon/etc. think they're at war with each other, this seems like something they'd be better off partnering/outsourcing.

If _I_ had an app with the mobile client reach of Twitter, I'd use it as an opportunity to become a security/auth provider (using a public key scheme), though.

</comment><comment><USER11> Urgh, I add 2FA then it asks to let people find me by phone number and I have to untick a load of "text me when..." stuff.

Not cool Twitter.

</comment><comment><USER12> I'm just gonna put this out there, could the reason they would not implement Google Authenticator be simply because some suit didn't want people thinking Google+ was in charge of their authentication or something? I hope not, but of all the companies Twitter seems like it would be too 'brand sensitive' or some crap.

</comment><comment><USER13> Twitter's using short codes that Google Voice doesn't support. It'd be nice if they had an alternate phone number they could text/verify from.

<comment><USER14> Thanks for the warning. I disabled Verizon texts so I can only get them through Google Voice now.

</comment></comment><comment><USER15> So... how do I protect my 2nd Twitter account? You can only associate your mobile number to 1 account. How will these social media companies protect the many accounts that they manage? While this is a good first step, it's a major fail. They didn't think through how Twitter is actually used and instead just put a band-aide on a problem.

</comment><comment><USER16> I wonder how to approach this if one has to manage multiple Twitter accounts... for example for several brands

Anyone any ideas?

</comment><comment><USER17> I can't see that option in my account

<comment><USER18> It's not rolled out to everyone yet apparently, I just enabled it on my account.

</comment></comment><comment><USER19> What if someone steals your phone?

<comment><USER20> And has your twitter credentials? Then you are SOL, same as with most other TFA systems out there.</comment></comment>


China blocks WhatsApp users from sending photos and video - <AUTHOR> https://www.engadget.com/2017/07/18/whatsapp-censorship-china-great-firewall/ <comment><USER2> I find it odd that the Chinese authorities allow text but not photos.

<comment><USER3> Photos and videos are harder to spy on.

However, this might be changing too...

[https://www.wsj.com/articles/chinas-stopchat-censors-can- now...](https://www.wsj.com/articles/chinas-stopchat-censors-can-now-erase- images-mid-transmission-1500363950)

</comment></comment><comment><USER4> If messages are end to end encrypted, how does this work ?

<comment><USER5> Maybe they are constantly interrupting the connection. Text messages would go through as the connection to the server to upload a text is for a very short duration whereas the image/video would require them to be connected for a longer time and the interruption would kill the upload.

(This is all conjecture obviously)</comment></comment>